CVE-2026-106057: Wummel Patool

High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days.

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execute commands with patool process privileges.

Affected products

• Wummel Patool: before 4.0.6 (fixed in 4.0.6)

Published 2026-10-07. Last modified 2026-10-07.